From 7f0ec68467dea6d1b6907eff7611d95869c8e8c7 Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Thu, 1 Oct 2026 22:08:01 -0700
Subject: [PATCH 1/3] feat: add additional low-risk hardening

---
 copr_script.sh | 47 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/copr_script.sh b/copr_script.sh
index 7dd6b25..a26442b 100644
--- a/copr_script.sh
+++ b/copr_script.sh
@@ -35,6 +35,10 @@ configs_to_enable=(
   # Equivalent to defaulting init_on_free=1, already set by our kargs
   CONFIG_INIT_ON_FREE_DEFAULT_ON
 
+  # https://cateee.net/lkddb/web-lkddb/INTEL_IOMMU_DEFAULT_ON.html
+  # Equivalent to intel_iommu=on, already set by our kargs
+  CONFIG_INTEL_IOMMU_DEFAULT_ON
+
   # https://www.kernelconfig.io/CONFIG_IOMMU_DEFAULT_DMA_STRICT
   # Equivalent to defaulting iommu.passthrough=0 iommu.strict=1, already set by our kargs
   CONFIG_IOMMU_DEFAULT_DMA_STRICT
@@ -44,6 +48,11 @@ configs_to_enable=(
   # Reduces side channel attack vectors with negligible perf impact and a
   # slight increase in kernel image size (<1% on x86_64, 5% on aarch64)
   CONFIG_ZERO_CALL_USED_REGS
+
+  # https://cateee.net/lkddb/web-lkddb/DEBUG_NOTIFIERS.html
+  # Sanity checks on notifier call chains, slight perf hit
+  # in exchange for reduced kernel panics/oopses and dangling pointers
+  CONFIG_DEBUG_NOTIFIERS
 )
 
 configs_to_disable=(
@@ -108,6 +117,10 @@ configs_to_disable=(
   # https://docs.kernel.org/networking/dsa/dsa.html
   CONFIG_NET_DSA
 
+  # https://cateee.net/lkddb/web-lkddb/LDISC_AUTOLOAD.html
+  # Don't autoload line disciplines, already set by our sysctl
+  CONFIG_LDISC_AUTOLOAD
+
 
   ############################################################
   ####### Features for mobile carriers / datacenters #########
@@ -301,6 +314,19 @@ configs_to_disable=(
   # https://cateee.net/lkddb/web-lkddb/DW_XDATA_PCIE.html
   CONFIG_DW_XDATA_PCIE
 
+  # https://cateee.net/lkddb/web-lkddb/LATENCYTOP.html
+  # https://en.wikipedia.org/wiki/LatencyTOP
+  # Tool for debugging kernel latency
+  CONFIG_LATENCYTOP
+
+  # https://cateee.net/lkddb/web-lkddb/XFS_ONLINE_SCRUB_STATS.html
+  # xfs_scrub monitoring and data collection tooling
+  CONFIG_XFS_ONLINE_SCRUB_STATS
+
+  # https://cateee.net/lkddb/web-lkddb/PROVIDE_OHCI1394_DMA_INIT.html
+  # Enables Firewire debugging over remote DMA
+  CONFIG_PROVIDE_OHCI1394_DMA_INIT
+
 
   ############################################################
   ################# Unused ports and devices #################
@@ -398,6 +424,27 @@ configs_to_disable=(
   # Provides support for the /dev/port device, which can RW directly to IO ports
   CONFIG_DEVPORT
 
+  # https://cateee.net/lkddb/web-lkddb/LIVEPATCH.html
+  # Attack surface, not useful with bootc 
+  CONFIG_LIVEPATCH
+
+  # https://cateee.net/lkddb/web-lkddb/SUNRPC_DEBUG.html
+  # Used for debugging NFS issues
+  CONFIG_SUNRPC_DEBUG
+
+  # https://cateee.net/lkddb/web-lkddb/X86_IOPL_IOPERM.html
+  # Provides emulation for legacy syscalls that are already blocked by lockdown
+  CONFIG_X86_IOPL_IOPERM
+
+  # https://cateee.net/lkddb/web-lkddb/CACHESTAT_SYSCALL.html
+  # Syscall that exposes page cache information, used primarily by DBMSes
+  CACHESTAT_SYSCALL
+
+  # https://cateee.net/lkddb/web-lkddb/MEM_SOFT_DIRTY.html
+  # Adds a soft dirty bit to PTEs that can be cleared by userspace.
+  # Used primarily by https://en.wikipedia.org/wiki/CRIU
+  CONFIG_MEM_SOFT_DIRTY
+
   # https://www.kernelconfig.io/CONFIG_DEVMEM
   # Provides support for the /dev/mem device, which can RW directly to memory
   CONFIG_DEVMEM

From 7a36d439c733c685c76d7c526faecae96a1f1491 Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Thu, 1 Oct 2026 22:08:52 -0700
Subject: [PATCH 2/3] categories

---
 copr_script.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/copr_script.sh b/copr_script.sh
index a26442b..6a76ab0 100644
--- a/copr_script.sh
+++ b/copr_script.sh
@@ -319,6 +319,10 @@ configs_to_disable=(
   # Tool for debugging kernel latency
   CONFIG_LATENCYTOP
 
+  # https://cateee.net/lkddb/web-lkddb/SUNRPC_DEBUG.html
+  # Used for debugging NFS issues
+  CONFIG_SUNRPC_DEBUG
+
   # https://cateee.net/lkddb/web-lkddb/XFS_ONLINE_SCRUB_STATS.html
   # xfs_scrub monitoring and data collection tooling
   CONFIG_XFS_ONLINE_SCRUB_STATS
@@ -428,10 +432,6 @@ configs_to_disable=(
   # Attack surface, not useful with bootc 
   CONFIG_LIVEPATCH
 
-  # https://cateee.net/lkddb/web-lkddb/SUNRPC_DEBUG.html
-  # Used for debugging NFS issues
-  CONFIG_SUNRPC_DEBUG
-
   # https://cateee.net/lkddb/web-lkddb/X86_IOPL_IOPERM.html
   # Provides emulation for legacy syscalls that are already blocked by lockdown
   CONFIG_X86_IOPL_IOPERM

From 3d8644bec93098edc669679f6025d27c4025d842 Mon Sep 17 00:00:00 2001
From: RoyalOughtness <129108030+RoyalOughtness@users.noreply.github.com>
Date: Thu, 1 Oct 2026 22:26:45 -0700
Subject: [PATCH 3/3] typo

---
 copr_script.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/copr_script.sh b/copr_script.sh
index 6a76ab0..18cfca6 100644
--- a/copr_script.sh
+++ b/copr_script.sh
@@ -438,7 +438,7 @@ configs_to_disable=(
 
   # https://cateee.net/lkddb/web-lkddb/CACHESTAT_SYSCALL.html
   # Syscall that exposes page cache information, used primarily by DBMSes
-  CACHESTAT_SYSCALL
+  CONFIG_CACHESTAT_SYSCALL
 
   # https://cateee.net/lkddb/web-lkddb/MEM_SOFT_DIRTY.html
   # Adds a soft dirty bit to PTEs that can be cleared by userspace.